CVE-2026-81685: openssl_encrypt before 1.4.9 Text Injection via Recovery Slot Metadata
opensslencrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bidi overrides or line-separator characters to forge warning text and deceive users during file removal operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openssl_encryptto a version that resolves this vulnerability.Fixed in 1.4.9
Event History
Frequently Asked Questions
Which installations should be reviewed?
Installations of OpenSSL openssl_encrypt before version 1.4.9 that use the desktop GUI are affected. The issue occurs in the irreversible-removal confirmation dialog.
What attacker-controlled input is involved?
An attacker needs to provide a crafted encrypted file whose recovery-slot identifier contains control characters, line separators, or bidi overrides. Exploitation also requires a user to interact with the resulting removal confirmation dialog.
What is the practical impact?
The crafted metadata can alter or forge text displayed in the warning dialog, potentially deceiving a user during a file-removal operation. The reported impact is limited to integrity; no confidentiality or availability impact is specified.